Bump the phpstan group with 2 updates

[dependabot]

Updates the requirements on phpstan/phpstan and spaze/phpstan-disallowed-calls to permit the latest version.
Updates phpstan/phpstan to 2.2.9

Commits

• See full diff in compare view

Updates spaze/phpstan-disallowed-calls to 4.14.0

Release notes

Sourced from spaze/phpstan-disallowed-calls's releases.

Bundled config for functions that are not timing-safe

New bundled configuration file disallowed-non-timing-safe-calls.neon for code that works with keys, tokens, and other secrets: it disallows hex2bin(), bin2hex(), base64_decode(), and base64_encode(), because their runtime depends on the processed bytes and can leak information about them, and recommends the sodium_* functions instead, or ParagonIE\ConstantTime\* when ext-sodium is not available (#433, #434)

includes:
    - vendor/spaze/phpstan-disallowed-calls/disallowed-non-timing-safe-calls.neon

Note: comparing secrets, digests, hashes is the other half - use hash_equals(), not ===, which is an operator, so no rule here can catch it.

Commits

• 90210a8 Tidy up after the non-timing-safe calls config (#434)
• 679d2ad Reword the disallowed-non-timing-safe-calls.neon docs paragraph
• 6368446 Rename NonTimingSafeCallsConfigTest to NonTimingSafeConfigFunctionCallsTest
• 2278723 Explain why disallowed-non-timing-safe-calls.neon is not self-applied
• 821edd4 Add a bundled config file for encoding functions that are not timing-safe (#433)
• 18d1308 Add a bundled config file for encoding functions that are not timing-safe
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions